In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()<\/p>\n
xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),
\ni.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with
\nrcu_dereference_protected(), stores NULL and dst_release()s the old dst.
\nThat is only safe if no other thread modifies sk_dst_cache concurrently.<\/p>\n
For a connected UDP socket that does not hold: the transmit fast path
\n(udp_sendmsg -> sk_dst_check -> sk_dst_reset) resets the cache locklessly
\nwith an atomic xchg(). A per-socket policy change racing a send can make
\nboth sides observe the same old dst and each dst_release() it, dropping
\nthe socket’s single reference twice and freeing the xfrm_dst bundle while
\nit is still referenced:<\/p>\n
BUG: KASAN: slab-use-after-free in dst_release
\n Write of size 4 at addr ffff88801897b6c0 by task exploit\/155
\n Call Trace:
\n …
\n dst_release (… .\/include\/linux\/rcuref.h:109)
\n xfrm_user_policy (.\/include\/net\/sock.h:2239 .\/include\/net\/sock.h:2256 net\/xfrm\/xfrm_state.c:3053)
\n do_ip_setsockopt (net\/ipv4\/ip_sockglue.c:1347)
\n ip_setsockopt (net\/ipv4\/ip_sockglue.c:1417)
\n do_sock_setsockopt (net\/socket.c:2368)
\n __sys_setsockopt (net\/socket.c:2393)
\n __x64_sys_setsockopt (net\/socket.c:2396)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:94)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n
Reachable by an unprivileged user via a user+network namespace.<\/p>\n
Use the atomic sk_dst_reset() so the cache is cleared and released with a
\nsingle xchg(): whichever side wins releases the dst once, the other sees
\nNULL and does nothing. Behaviour is otherwise unchanged.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()<\/p>\n
xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),
\ni.e<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4656","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4656"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4656"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}